Check an IP Address, Domain Name, Subnet, or ASN

222.111.99.91 was found in our database!

$ whois 222.111.99.91

country·🇰🇷 South Korea

city·Dobong-gu

isp·Korea Telecom

asn·AS4766

network·Standard

$ sikker risk 222.111.99.91scoring →

confidence

59%Medium

first_seen·May 6, 2026

last_seen·1h ago

sessions·1

events·1

$ sikker protocols 222.111.99.91

SSH

1 / 1

$ sikker summary 222.111.99.91

222.111.99.91 has a threat confidence score of 59%. This IP address from South Korea (AS4766, Korea Telecom) has been observed in 1 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on May 6, 2026, most recently active May 6, 2026.

$ sikker behaviors 222.111.99.91catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery1x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 222.111.99.91

ssh_routeros_ip_cloud_print_probe2 ssh_uname_all1 ssh_cat_proc_cpuinfo1 ssh_ps_ef_grep_miner_bracket_case1 ssh_ifconfig_interface_enumeration1 ssh_routeros_user_set_password_id01 ssh_echo_hi_pipe_cat_numbering_test1 ssh_locate_telegram_tdata_identifier1 ssh_routeros_interface_lte_print_probe1 ssh_routeros_ip_cloud_set_ddns_enabled1 ssh_ps_pipe_grep_miner_case_insensitive1 ssh_ls_telegram_tdata_and_gsm_sms_artifacts1

$ sikker related 222.111.99.91

🇰🇷·More threats fromSouth Korea→AS·More threats fromKorea Telecom→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
221.159.119.6	74%	1,037
121.178.185.141	82%	690
203.228.30.198	100%	1,156
14.63.196.175	100%	9,631
220.118.173.234	100%	1,017

IP Address	Confidence	Events
221.159.119.6	74%	1,037
39.126.101.130	78%	15
175.118.127.138	100%	393
49.142.74.19	88%	71
110.10.176.224	100%	7,018